pulp-python 3.32.1__tar.gz → 3.33.0__tar.gz

{pulp_python-3.32.1 → pulp_python-3.33.0}/CHANGES.md

@@ -8,6 +8,24 @@
 
 [//]: # (towncrier release notes start)
 
+## 3.33.0 (2026-08-07) {: #3.33.0 }
+
+#### Features {: #3.33.0-feature }
+
+- Added yank support (PEP 592).
+  [#1270](https://github.com/pulp/pulp_python/issues/1270)
+- Added `version_specifier` filter to package content API for PEP 440 version matching.
+  [#1277](https://github.com/pulp/pulp_python/issues/1277)
+- Added support for uploading packages with Core Metadata 2.5 via twine.
+  [#1321](https://github.com/pulp/pulp_python/issues/1321)
+
+#### Bugfixes {: #3.33.0-bugfix }
+
+- Fixed Simple API cache incorrectly serving JSON responses for HTML requests when clients used `?format=json`.
+  [#1302](https://github.com/pulp/pulp_python/issues/1302)
+
+---
+
 ## 3.32.1 (2026-07-29) {: #3.32.1 }
 
 #### Bugfixes {: #3.32.1-bugfix }

{pulp_python-3.32.1 → pulp_python-3.33.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: pulp-python
-Version: 3.32.1
+Version: 3.33.0
 Summary: pulp-python plugin for the Pulp Project
 Author-email: Pulp Team <pulp-list@redhat.com>
 Project-URL: Homepage, https://pulpproject.org

{pulp_python-3.32.1 → pulp_python-3.33.0}/pulp_python/app/__init__.py

@@ -12,7 +12,7 @@ class PulpPythonPluginAppConfig(PulpPluginAppConfig):
 
     name = "pulp_python.app"
     label = "python"
-    version = "3.32.1"
+    version = "3.33.0"
     python_package_name = "pulp-python"
     domain_compatible = True
 

pulp_python-3.33.0/pulp_python/app/migrations/0023_packageyank.py

@@ -0,0 +1,50 @@
+# Generated by Django 5.2.16 on 2026-07-30 10:44
+
+import django.db.models.deletion
+from django.db import migrations, models
+
+import pulpcore.app.util
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ("python", "0022_pythonblocklistentry"),
+    ]
+
+    operations = [
+        migrations.CreateModel(
+            name="PackageYank",
+            fields=[
+                (
+                    "content_ptr",
+                    models.OneToOneField(
+                        auto_created=True,
+                        on_delete=django.db.models.deletion.CASCADE,
+                        parent_link=True,
+                        primary_key=True,
+                        serialize=False,
+                        to="core.content",
+                    ),
+                ),
+                ("name_normalized", models.TextField()),
+                ("version", models.TextField()),
+                ("yanked_reason", models.TextField(default="")),
+                (
+                    "_pulp_domain",
+                    models.ForeignKey(
+                        default=pulpcore.app.util.get_domain_pk,
+                        on_delete=django.db.models.deletion.PROTECT,
+                        to="core.domain",
+                    ),
+                ),
+            ],
+            options={
+                "default_related_name": "%(app_label)s_%(model_name)s",
+                "unique_together": {
+                    ("name_normalized", "version", "yanked_reason", "_pulp_domain")
+                },
+            },
+            bases=("core.content",),
+        ),
+    ]

{pulp_python-3.32.1 → pulp_python-3.33.0}/pulp_python/app/models.py

@@ -204,8 +204,6 @@ class PythonPackageContent(Content):
     sha256 = models.CharField(db_index=True, max_length=64)
     metadata_sha256 = models.CharField(max_length=64, null=True)
     size = models.BigIntegerField(default=0)
-    # yanked and yanked_reason are not implemented because they are mutable
-
     # From pulpcore
     PROTECTED_FROM_RECLAIM = False
     TYPE = "python"
@@ -289,6 +287,32 @@ class PackageProvenance(Content):
         unique_together = ("sha256", "_pulp_domain")
 
 
+class PackageYank(Content):
+    """
+    A marker content type indicating a package version is yanked in a repository (PEP 592).
+
+    Its presence in a repository version means all files for the matching
+    (name_normalized, version) pair are yanked. Yank/unyank operations
+    add/remove this marker, creating new repository versions.
+    """
+
+    TYPE = "python_yank"
+    repo_key_fields = ("name_normalized", "version")
+
+    name_normalized = models.TextField()
+    version = models.TextField()
+    yanked_reason = models.TextField(default="")
+
+    _pulp_domain = models.ForeignKey("core.Domain", default=get_domain_pk, on_delete=models.PROTECT)
+
+    def __str__(self):
+        return f"<{self._meta.object_name}: {self.name_normalized} [{self.version}]>"
+
+    class Meta:
+        default_related_name = "%(app_label)s_%(model_name)s"
+        unique_together = ("name_normalized", "version", "yanked_reason", "_pulp_domain")
+
+
 class PythonPublication(Publication, AutoAddObjPermsMixin):
     """
     A Publication for PythonContent.
@@ -364,7 +388,7 @@ class PythonRepository(Repository, AutoAddObjPermsMixin):
     """
 
     TYPE = "python"
-    CONTENT_TYPES = [PythonPackageContent, PackageProvenance]
+    CONTENT_TYPES = [PythonPackageContent, PackageProvenance, PackageYank]
     REMOTE_TYPES = [PythonRemote]
     PULL_THROUGH_SUPPORTED = True
 

{pulp_python-3.32.1 → pulp_python-3.33.0}/pulp_python/app/pypi/serializers.py

@@ -136,3 +136,24 @@ class PackageUploadTaskSerializer(serializers.Serializer):
     session = serializers.CharField(allow_null=True)
     task = serializers.CharField()
     task_start_time = serializers.DateTimeField(allow_null=True)
+
+
+class YankSerializer(serializers.Serializer):
+    """
+    A Serializer for yank/unyank requests (PEP 592).
+    """
+
+    name = serializers.CharField(
+        help_text=_("The name of the package to yank or unyank."),
+        required=True,
+    )
+    version = serializers.CharField(
+        help_text=_("The version of the package to yank or unyank."),
+        required=True,
+    )
+    yanked_reason = serializers.CharField(
+        help_text=_("The reason for yanking the package version."),
+        required=False,
+        allow_blank=True,
+        default="",
+    )

{pulp_python-3.32.1 → pulp_python-3.33.0}/pulp_python/app/pypi/views.py

@@ -29,6 +29,7 @@ from rest_framework.renderers import BrowsableAPIRenderer, JSONRenderer, Templat
 from rest_framework.response import Response
 from rest_framework.viewsets import ViewSet
 
+from pulpcore.plugin.serializers import AsyncOperationResponseSerializer
 from pulpcore.plugin.tasking import dispatch
 from pulpcore.plugin.util import get_domain, get_url
 from pulpcore.plugin.viewsets import OperationPostponedResponse
@@ -37,6 +38,7 @@ from pulp_python.app import tasks
 from pulp_python.app.cache import PythonApiCache, find_base_path_cached
 from pulp_python.app.models import (
     PackageProvenance,
+    PackageYank,
     PythonDistribution,
     PythonPackageContent,
     PythonPublication,
@@ -46,6 +48,7 @@ from pulp_python.app.pypi.serializers import (
     PackageUploadSerializer,
     PackageUploadTaskSerializer,
     SummarySerializer,
+    YankSerializer,
 )
 from pulp_python.app.utils import (
     PYPI_LAST_SERIAL,
@@ -356,6 +359,8 @@ class SimpleView(PackageUploadMixin, ViewSet):
                 "upload_time": release_package.upload_time,
                 "version": release_package.version,
                 "provenance": release_package.provenance_url,
+                "yanked": release_package.is_yanked,
+                "yanked_reason": release_package.yanked_reason or "",
             }
 
         rfilter = get_remote_package_filter(remote)
@@ -408,6 +413,11 @@ class SimpleView(PackageUploadMixin, ViewSet):
                 "version",
                 "has_provenance",
             )
+            yank_markers = dict(
+                PackageYank.objects.filter(
+                    pk__in=repo_ver.content, name_normalized=normalized
+                ).values_list("version", "yanked_reason")
+            )
             local_releases = {
                 p["filename"]: {
                     **p,
@@ -418,6 +428,8 @@ class SimpleView(PackageUploadMixin, ViewSet):
                         if p["has_provenance"]
                         else None
                     ),
+                    "yanked": p["version"] in yank_markers,
+                    "yanked_reason": yank_markers.get(p["version"], ""),
                 }
                 for p in packages
             }
@@ -493,12 +505,18 @@ class MetadataView(PyPIMixin, ViewSet):
             headers = {PYPI_LAST_SERIAL: str(PYPI_SERIAL_CONSTANT)}
             if settings.DOMAIN_ENABLED:
                 domain = get_domain()
+            yank_markers = dict(
+                PackageYank.objects.filter(
+                    pk__in=repo_ver.content, name_normalized=normalized
+                ).values_list("version", "yanked_reason")
+            )
             json_body = python_content_to_json(
                 path,
                 package_content,
                 version=version,
                 domain=domain,
                 repository_version=repo_ver,
+                yank_markers=yank_markers,
             )
             if json_body:
                 return Response(data=json_body, headers=headers)
@@ -586,3 +604,78 @@ class ProvenanceView(PyPIMixin, ViewSet):
                 if provenance:
                     return Response(data=provenance.provenance)
         return HttpResponseNotFound(f"{package} {version} {filename} provenance does not exist.")
+
+
+class YankView(PyPIMixin, ViewSet):
+    """View for yank/unyank requests (PEP 592)."""
+
+    endpoint_name = "yank"
+    DEFAULT_ACCESS_POLICY = {
+        "statements": [
+            {
+                "action": ["yank", "unyank"],
+                "principal": "authenticated",
+                "effect": "allow",
+                "condition": "index_has_repo_perm:python.modify_pythonrepository",
+            },
+        ],
+    }
+
+    @extend_schema(
+        request=YankSerializer,
+        responses={202: AsyncOperationResponseSerializer},
+        summary="Yank a package version",
+    )
+    def yank(self, request, path):
+        """Yank a package version, marking all its files with data-yanked."""
+        repo = self.distribution.repository
+        if not repo:
+            return HttpResponseBadRequest(reason="Index is not pointing to a repository")
+
+        serializer = YankSerializer(data=request.data)
+        serializer.is_valid(raise_exception=True)
+
+        normalized = canonicalize_name(serializer.validated_data["name"])
+        version = serializer.validated_data["version"]
+        repo_ver = self.get_repository_version(self.distribution)
+        if not PythonPackageContent.objects.filter(
+            pk__in=repo_ver.content, name_normalized=normalized, version=version
+        ).exists():
+            return HttpResponseNotFound(f"{normalized}=={version} not found in repository")
+
+        result = dispatch(
+            tasks.ayank_package,
+            exclusive_resources=[repo],
+            kwargs={
+                "repository_pk": str(repo.pk),
+                "name": serializer.validated_data["name"],
+                "version": serializer.validated_data["version"],
+                "yanked_reason": serializer.validated_data.get("yanked_reason", ""),
+            },
+        )
+        return OperationPostponedResponse(result, request)
+
+    @extend_schema(
+        request=YankSerializer,
+        responses={202: AsyncOperationResponseSerializer},
+        summary="Unyank a package version",
+    )
+    def unyank(self, request, path):
+        """Unyank a package version, unmarking all its files with data-yanked."""
+        repo = self.distribution.repository
+        if not repo:
+            return HttpResponseBadRequest(reason="Index is not pointing to a repository")
+
+        serializer = YankSerializer(data=request.data)
+        serializer.is_valid(raise_exception=True)
+
+        result = dispatch(
+            tasks.aunyank_package,
+            exclusive_resources=[repo],
+            kwargs={
+                "repository_pk": str(repo.pk),
+                "name": serializer.validated_data["name"],
+                "version": serializer.validated_data["version"],
+            },
+        )
+        return OperationPostponedResponse(result, request)

{pulp_python-3.32.1 → pulp_python-3.33.0}/pulp_python/app/serializers.py

@@ -683,6 +683,25 @@ class PackageProvenanceSerializer(core_serializers.NoArtifactContentUploadSerial
         model = python_models.PackageProvenance
 
 
+class PackageYankSerializer(core_serializers.NoArtifactContentSerializer):
+    """
+    Read-only serializer for PackageYank content units (PEP 592).
+    Used by PackageYankViewSet to expose yank markers via the Pulp REST API.
+    """
+
+    name_normalized = serializers.CharField(read_only=True)
+    version = serializers.CharField(read_only=True)
+    yanked_reason = serializers.CharField(read_only=True)
+
+    class Meta:
+        fields = core_serializers.NoArtifactContentSerializer.Meta.fields + (
+            "name_normalized",
+            "version",
+            "yanked_reason",
+        )
+        model = python_models.PackageYank
+
+
 class MultipleChoiceArrayField(serializers.MultipleChoiceField):
     """
     A wrapper to make sure this DRF serializer works properly with ArrayFields.

{pulp_python-3.32.1 → pulp_python-3.33.0}/pulp_python/app/tasks/__init__.py

@@ -7,3 +7,4 @@ from .repair import repair  # noqa:F401
 from .sync import sync  # noqa:F401
 from .upload import upload, upload_group  # noqa:F401
 from .vulnerability_report import get_repo_version_content  # noqa:F401
+from .yank import aunyank_package, ayank_package  # noqa:F401

{pulp_python-3.32.1 → pulp_python-3.33.0}/pulp_python/app/tasks/sync.py

@@ -24,6 +24,7 @@ from pulpcore.plugin.stages import (
 from pulp_python.app.exceptions import UnsupportedProtocolError
 from pulp_python.app.models import (
     PackageProvenance,
+    PackageYank,
     PythonPackageContent,
     PythonRemote,
 )
@@ -265,6 +266,15 @@ class PulpMirror(Mirror):
                         )
                         d_artifacts.append(metadata_artifact)
 
+                    if upstream_pkg.is_yanked:
+                        yank_marker = PackageYank(
+                            name_normalized=pkg.name,
+                            version=version,
+                            yanked_reason=upstream_pkg.yanked_reason or "",
+                        )
+                        yank_dc = DeclarativeContent(content=yank_marker, d_artifacts=[])
+                        await self.python_stage.put(yank_dc)
+
                 dc = DeclarativeContent(content=package, d_artifacts=d_artifacts)
                 declared_contents[entry["filename"]] = dc
                 await self.python_stage.put(dc)

pulp_python-3.33.0/pulp_python/app/tasks/yank.py

@@ -0,0 +1,64 @@
+from packaging.utils import canonicalize_name
+
+from pulpcore.plugin.exceptions import ValidationError
+from pulpcore.plugin.tasking import aadd_and_remove
+
+from pulp_python.app.models import PackageYank, PythonPackageContent, PythonRepository
+
+
+async def ayank_package(repository_pk, name, version, yanked_reason=""):
+    """
+    Yank a package version in a repository by adding a PackageYank marker.
+    Creates a new repository version with the yank marker added.
+    """
+    normalized = canonicalize_name(name)
+    repository = await PythonRepository.objects.aget(pk=repository_pk)
+    latest = await repository.alatest_version()
+
+    exists = await PythonPackageContent.objects.filter(
+        pk__in=latest.content, name_normalized=normalized, version=version
+    ).aexists()
+    if not exists:
+        raise ValidationError(f"Package {name}=={version} not found in repository")
+
+    existing_yank = await PackageYank.objects.filter(
+        pk__in=latest.content, name_normalized=normalized, version=version
+    ).afirst()
+    if existing_yank and existing_yank.yanked_reason == yanked_reason:
+        return
+
+    yank_marker, _ = await PackageYank.objects.aget_or_create(
+        name_normalized=normalized,
+        version=version,
+        yanked_reason=yanked_reason,
+        _pulp_domain_id=repository.pulp_domain_id,
+    )
+
+    await aadd_and_remove(
+        repository_pk=repository.pk,
+        add_content_units=[yank_marker.pk],
+        remove_content_units=[],
+    )
+
+
+async def aunyank_package(repository_pk, name, version):
+    """
+    Unyank a package version in a repository by removing its PackageYank marker.
+    Creates a new repository version with the yank marker removed.
+    """
+    normalized = canonicalize_name(name)
+    repository = await PythonRepository.objects.aget(pk=repository_pk)
+    latest = await repository.alatest_version()
+
+    yank_marker = await PackageYank.objects.filter(
+        pk__in=latest.content, name_normalized=normalized, version=version
+    ).afirst()
+
+    if yank_marker is None:
+        return
+
+    await aadd_and_remove(
+        repository_pk=repository.pk,
+        add_content_units=[],
+        remove_content_units=[yank_marker.pk],
+    )

{pulp_python-3.32.1 → pulp_python-3.33.0}/pulp_python/app/urls.py

@@ -7,6 +7,7 @@ from pulp_python.app.pypi.views import (
     PyPIView,
     SimpleView,
     UploadView,
+    YankView,
 )
 
 if settings.DOMAIN_ENABLED:
@@ -40,5 +41,7 @@ urlpatterns = [
         SimpleView.as_view({"get": "list", "post": "create"}),
         name="simple-detail",
     ),
+    path(PYPI_API_URL + "yank/", YankView.as_view({"post": "yank"}), name="yank"),
+    path(PYPI_API_URL + "unyank/", YankView.as_view({"post": "unyank"}), name="unyank"),
     path(PYPI_API_URL, PyPIView.as_view({"get": "retrieve"}), name="pypi-detail"),
 ]

{pulp_python-3.32.1 → pulp_python-3.33.0}/pulp_python/app/utils.py

@@ -30,7 +30,7 @@ log = logging.getLogger(__name__)
 PYPI_LAST_SERIAL = "X-PYPI-LAST-SERIAL"
 """TODO This serial constant is temporary until Python repositories implements serials"""
 PYPI_SERIAL_CONSTANT = 1000000000
-SUPPORTED_METADATA_VERSIONS = ("1.0", "1.1", "1.2", "2.0", "2.1", "2.2", "2.3", "2.4")
+SUPPORTED_METADATA_VERSIONS = ("1.0", "1.1", "1.2", "2.0", "2.1", "2.2", "2.3", "2.4", "2.5")
 
 SIMPLE_API_VERSION = "1.1"
 PYPI_SIMPLE_V1_HTML = "application/vnd.pypi.simple.v1+html"
@@ -50,7 +50,6 @@ simple_index_template = """<!DOCTYPE html>
 </html>
 """
 
-# TODO in the future: data-yanked (not implemented yet because it is mutable)
 simple_detail_template = """<!DOCTYPE html>
 <html>
   <head>
@@ -62,6 +61,7 @@ simple_detail_template = """<!DOCTYPE html>
     {%- for pkg in project_packages %}
       <a href="{{ pkg.url }}#sha256={{ pkg.sha256 }}" rel="internal"
       {%- if pkg.requires_python %} data-requires-python="{{ pkg.requires_python }}" {%- endif %}
+      {%- if pkg.yanked %} data-yanked="{{ pkg.yanked_reason }}" {%- endif %}
       {%- if pkg.metadata_sha256 %} data-dist-info-metadata="sha256={{ pkg.metadata_sha256 }}" data-core-metadata="sha256={{ pkg.metadata_sha256 }}"
       {%- endif %} {% if pkg.provenance -%}
       data-provenance="{{ pkg.provenance }}"{% endif %}>{{ pkg.filename }}</a><br/>
@@ -362,7 +362,12 @@ def fetch_json_release_metadata(name: str, version: str, remotes: set[Remote]) -
 
 
 def python_content_to_json(
-    base_path, content_query, version=None, domain=None, repository_version=None
+    base_path,
+    content_query,
+    version=None,
+    domain=None,
+    repository_version=None,
+    yank_markers=None,
 ):
     """
     Converts a QuerySet of PythonPackageContent into the PyPi JSON format
@@ -375,6 +380,8 @@ def python_content_to_json(
 
     Returns None if version is specified but not found within content_query
     """
+    if yank_markers is None:
+        yank_markers = {}
     if repository_version:
         content_query = content_query.annotate(
             active_membership=FilteredRelation(
@@ -386,25 +393,32 @@ def python_content_to_json(
             ),
             repo_added_time=F("active_membership__pulp_created"),
         )
-    full_metadata = {"last_serial": 0}  # For now the serial field isn't supported by Pulp
-    latest_content = latest_content_version(content_query, version)
+
+    all_content = list(content_query)
+    for content in all_content:
+        content.yanked = content.version in yank_markers
+        content.yanked_reason = yank_markers.get(content.version)
+
+    latest_content = latest_content_version(all_content, version)
     if not latest_content:
         return None
-    full_metadata.update({"info": python_content_to_info(latest_content[0])})
-    full_metadata.update({"releases": python_content_to_releases(content_query, base_path, domain)})
-    full_metadata.update({"urls": python_content_to_urls(latest_content, base_path, domain)})
+
+    full_metadata = {"last_serial": 0}  # For now the serial field isn't supported by Pulp
+    full_metadata["info"] = python_content_to_info(latest_content[0])
+    full_metadata["releases"] = python_content_to_releases(all_content, base_path, domain)
+    full_metadata["urls"] = python_content_to_urls(latest_content, base_path, domain)
     return full_metadata
 
 
-def latest_content_version(content_query, version):
+def latest_content_version(all_content, version):
     """
-    Walks through the content QuerySet and finds the instances that is the latest version.
+    Walks through the content list and finds the instances that are the latest version.
     If 'version' is specified, the function instead tries to find content instances
     with that version and will return an empty list if nothing is found
     """
     latest_version = version
     latest_content = []
-    for content in content_query:
+    for content in all_content:
         if version and parse(version) == parse(content.version):
             latest_content.append(content)
         elif not latest_version or parse(content.version) > parse(latest_version):
@@ -462,8 +476,8 @@ def python_content_to_info(content):
         "platform": content.platform or "",
         "requires_dist": json_to_dict(content.requires_dist) or None,
         "classifiers": json_to_dict(content.classifiers) or None,
-        "yanked": False,  # These are no longer used on PyPI, but are still present
-        "yanked_reason": None,
+        "yanked": getattr(content, "yanked", False),
+        "yanked_reason": getattr(content, "yanked_reason", None),
         # New core metadata (Version 2.1, 2.2, 2.4)
         "provides_extras": json_to_dict(content.provides_extras) or None,
         "dynamic": json_to_dict(content.dynamic) or None,
@@ -472,13 +486,13 @@ def python_content_to_info(content):
     }
 
 
-def python_content_to_releases(content_query, base_path, domain=None):
+def python_content_to_releases(all_content, base_path, domain=None):
     """
-    Takes a QuerySet of PythonPackageContent and returns a dictionary of releases
+    Takes a list of PythonPackageContent and returns a dictionary of releases
     with each key being a version and value being a list of content for that version of the package
     """
     releases = defaultdict(lambda: [])
-    for content in content_query:
+    for content in all_content:
         releases[content.version].append(
             python_content_to_download_info(content, base_path, domain)
         )
@@ -535,22 +549,22 @@ def python_content_to_download_info(content, base_path, domain=None):
             (getattr(content, "repo_added_time", None) or content.pulp_created).isoformat()
         ),
         "url": url,
-        "yanked": False,
-        "yanked_reason": None,
+        "yanked": getattr(content, "yanked", False),
+        "yanked_reason": getattr(content, "yanked_reason", None),
     }
 
 
-def write_simple_index(project_names, streamed=False):
+def write_simple_index(project_names):
     """Writes the simple index."""
     simple = Template(simple_index_template)
     context = {
         "SIMPLE_API_VERSION": SIMPLE_API_VERSION,
         "projects": ((x, canonicalize_name(x)) for x in project_names),
     }
-    return simple.stream(**context) if streamed else simple.render(**context)
+    return simple.render(**context)
 
 
-def write_simple_detail(project_name, project_packages, streamed=False):
+def write_simple_detail(project_name, project_packages):
     """Writes the simple detail page of a package."""
     detail = Template(simple_detail_template, autoescape=True)
     context = {
@@ -558,7 +572,7 @@ def write_simple_detail(project_name, project_packages, streamed=False):
         "project_name": project_name,
         "project_packages": project_packages,
     }
-    return detail.stream(**context) if streamed else detail.render(**context)
+    return detail.render(**context)
 
 
 def write_simple_index_json(project_names):
@@ -591,7 +605,12 @@ def write_simple_detail_json(project_name, project_packages):
                 "core-metadata": (
                     {"sha256": package["metadata_sha256"]} if package["metadata_sha256"] else False
                 ),
-                # yanked and yanked_reason are not implemented because they are mutable
+                # PEP 592
+                "yanked": (
+                    package.get("yanked_reason")
+                    if package.get("yanked") and package.get("yanked_reason")
+                    else package.get("yanked", False)
+                ),
                 # (v1.1, PEP 700)
                 "size": package["size"],
                 "upload-time": format_upload_time(package["upload_time"]),